EUVD-2026-101025
GHSA-gjqg-f9ch-24cr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach /preapproval.asmx SOAP endpoint
-
DeliverySend crafted GetUser request
-
ExploitInject stacked SQL via sUserID
-
ExecutionExecute queries on MSSQL backend
-
ImpactExfiltrate/modify data or run OS commands
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the WebAlliance eCommerce application expose the /preapproval.asmx SOAP web service endpoint and that its GetUser method be reachable over the network; the attacker needs only to submit a sUserID parameter containing a single quote and a stacked SQL query. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special configuration is required, so default internet- or network-reachable deployments are exploitable. The practical ability to run OS commands further depends on the MSSQL backend having command-execution features (e.g., xp_cmdshell) enabled and on the service account's privileges; data read/write via injection does not require that. The main limiting factor is deployment reach: the affected version is unspecified and the product is a niche vendor platform, so exposure depends on whether the vulnerable endpoint is network-accessible. |
| Impact | All available signals point to genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with full C:H/I:H/A:H impact, yielding a 9.8 base score that is internally consistent with the description of unauthenticated remote SQL injection. Because the flaw permits stacked queries against a Microsoft SQL Server backend, the realistic impact extends beyond data disclosure to data tampering and potential OS command execution (e.g., via xp_cmdshell), reinforcing the I:H/A:H ratings. No EPSS probability, CISA KEV entry, or explicit POC flag was supplied in the input, so exploitation-likelihood and in-the-wild signals cannot be corroborated; the single Rapid7 advisory confirms the vulnerability's existence and class but the input does not mark published exploit code. The affected product version is explicitly missing from the input ('[VERSION - missing]'), which limits precise applicability scoping. Net assessment: this is a real priority on technical merits (trivial unauthenticated SQLi with DB/host impact), tempered by the absence of exploitation-probability data and unknown real-world deployment footprint of this niche vendor. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP SOAP request to the GetUser method of /preapproval.asmx, supplying a sUserID value containing a single quote and a stacked SQL statement. The injected query executes against the backend Microsoft SQL Server, letting the attacker read and modify database contents and potentially run operating-system commands on the DB host. No public exploit is marked in the input, though Rapid7 has published a technical advisory describing the issue. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Unauthenticated SQL injection in Channel Software WebAlliance eCommerce lets remote attackers read and write arbitrary data in the backend Microsoft SQL Server - and potentially execute operating-system commands - by sending a crafted sUserID value containing a single quote and a stacked SQL query to the SOAP GetUser method on /preapproval.asmx. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms that no authentication, user interaction, or special configuration is required, so any internet- or network-reachable deployment of this niche eCommerce platform is exposed; the practical limit on full command execution is whether the MSSQL backend has features such as xp_cmdshell enabled and what privileges the database service account holds. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS score reported, but the combination of an unauthenticated network-facing injection point with full confidentiality and integrity impact justifies treating this as a high-priority exposure to enumerate and mitigate.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must begin with exposure reduction and compensating controls rather than a version upgrade. The highest-value action is to remove the attack surface: block /preapproval.asmx (and the SOAP GetUser method specifically) at the reverse proxy, load balancer, or WAF so only trusted internal integrations can reach it - the trade-off is that any legitimate preapproval workflow calling that endpoint from external or partner systems will break, so coordinate with integration owners first. Confirm the deployment is not directly internet-facing, and if it must be, restrict it to allow-listed source IPs. Add a WAF rule that inspects SOAP XML bodies for single-quote and stacked-query patterns in the sUserID element, but treat this as a partial mitigation only, since XML encoding and alternate injection syntax can evade signature-based filtering. On the database side, harden the service account to the minimum privileges needed by the application, disable xp_cmdshell, OLE Automation, and other command-execution extended procedures if business processes allow - note this may break legitimate administrative jobs or application features that depend on them. Enable and monitor MSSQL audit logging and errors, and hunt historical logs for anomalous queries against the user/preapproval tables, since exploitation may already have occurred without alerting. Engage Channel Software directly for a patched build or a statement of support status, and monitor the Rapid7 disclosure at https://www.rapid7.com/blog/post/ve-unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce/ for updates; if the vendor is unresponsive, treat the platform as end-of-life and plan migration.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-89 SQL injection in an ASP.NET SOAP web service (.asmx endpoint), where the GetUser method of /preapproval.asmx takes a sUserID parameter and interpolates it directly into a T-SQL statement instead of using parameterized queries or stored procedures. Because Microsoft SQL Server accepts stacked queries - multiple statements separated by semicolons in a single batch - an attacker who supplies a single quote to close the string literal can append arbitrary statements, which elevates the issue from simple record disclosure to full read/write access over the database objects reachable by the service account. The SOAP layer adds no protection here: the payload travels inside the XML request body, so generic query-string filtering and many simple WAF signatures may not inspect it, and the endpoint is designed to be consumed programmatically, meaning legitimate and malicious requests look identical. The most severe downstream consequence noted in the source reporting is command execution on the database host, which in MSSQL typically requires the service account to have sufficient privileges and features like xp_cmdshell or OLE Automation to be enabled - conditions that are common in older, permission-heavy deployments but are not guaranteed by the injection alone.
Know when Weballiance Ecommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable SOAP endpoint (AV:N/PR:N/UI:N) with trivial single-quote injection (AC:L); stacked queries grant full read/write and potential host command execution (C:H/I:H/A:H).
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
DescriptionCVE.org
SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION - missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.
Executive ViewAI
Channel Software WebAlliance eCommerce contains a critical unauthenticated SQL injection in the SOAP GetUser method on /preapproval.asmx that can let remote attackers read or write arbitrary data in the backend Microsoft SQL Server and potentially execute operating-system commands depending on database configuration. Because no authentication or user interaction is required, any internet- or network-reachable deployment is exposed, creating risk of data theft, transaction manipulation, fraud, or broader server compromise. Leadership should prioritize immediate containment; no vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to /preapproval.asmx, WAF/virtual patching for SQL injection, disabling xp_cmdshell and other risky MSSQL features, enforcing least privilege on the MSSQL service account, rotating exposed credentials, and monitoring MSSQL and web logs for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB